EUVD-2021-11370

Malware in sbrugna...

CVE-2021-24458: Improper Neutralization of Special Elements used in an SQL Command

The getayspopupboxes and getpopupcategories functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...